Privacy Notice

Wavela Experiences Limited ("Wavela", "we", "us", or "our") operates an online marketplace and hospitality technology platform (the "Platform") that facilitates the discovery, booking and management of hospitality, tourism and lifestyle experiences, including short-term accommodation rentals, curated experiences, events, excursions, Water-Based Services and other related services.

For the purposes of applicable data protection laws, Wavela is the Data Controller in respect of Personal Data collected through the Platform, except where otherwise expressly stated.

We determine the purposes and means of processing Personal Data collected through the Platform and ensure that such processing is carried out in accordance with applicable law.

This Privacy Notice applies to Personal Data collected through: the Wavela website and related digital services; Partner onboarding processes; Guest bookings and reservations; Water-Based Service bookings; communications with Users; customer support interactions; marketing and promotional activities; and any other services made available through the Platform.

This Privacy Notice applies to all Users of the Platform, including Guests, Partners, property owners, boat operators and Water-based Service providers, corporate clients, and visitors to the Platform.

By accessing or using the Platform, creating an Account, making a Booking, listing a Property or Experience, engaging with a Water-Based Service, communicating with Wavela, or otherwise providing Personal Data to us, you acknowledge that you have read and understood this Privacy Notice and that your Personal Data will be processed in accordance with its terms.

In this Privacy Notice, the following words and expressions have the meanings set out below:

We may collect Personal Data that you voluntarily provide to us, including your full name; email address; telephone number; date of birth, account login credentials; profile photographs; payment and billing information; booking information; communications and correspondence; reviews; ratings and feedback; and any other information you choose to provide.

Where you make a Booking through the Platform, we may collect: reservation details; dates of travel or accommodation; number of occupants or passengers; transaction information; booking history; and communications with Partners.

Where you register as a Partner, Experience Provider or Water-Based Service Provider, we may collect business or trading name; bank account details and other payout information; vessel registration documents; applicable insurance documents; captain's licence or other relevant qualification documents where applicable; and information relating to Listings and their pricing, availability, photographs, descriptions, communications and other information relating to the services offered through the Platform.

We may collect certain technical and logging information including: IP address; browser type and information; device identifiers; operating system information; application or website usage data; location information where enabled; session and administrative log data; referral URLs; and analytics information relating to your use of the Platform.

We collect Personal Data through various means, including:

• when you create an Account on the Platform;
• When you complete your profile or submit verification documents;
• when you submit vessel registration, insurance, captain's licence or other verification documents;
• when you make, modify or cancel a Booking;
• when you create or manage a Listing;
• when you communicate with other Users through the Platform;
• when you contact customer support or submit enquiries;
• when you participate in promotions, surveys, competitions or marketing campaigns;
• when you submit reviews, ratings or feedback;
• when you interact with our website, Platform features or advertisements; and
• through third-party service providers, business partners, payment processors, analytics providers and publicly available sources where permitted by law.

We may also generate or derive information from the data we collect, including statistical, analytical and behavioural insights relating to Platform usage, booking patterns and service performance.

Wavela Processes Personal Data only where there is a lawful basis for doing so under Applicable Data Protection Laws.

We may Process Personal Data for the following purposes:

• creating and managing User Accounts;
• facilitating Bookings, reservations and transactions;
• verifying User information and preventing fraud;
• onboarding and managing Partners;
• facilitating communications between Guests and Partners;
• processing payments, refunds and chargebacks;
• providing customer support and dispute resolution services;
• maintaining the security, integrity and functionality of the Platform;
• conducting audits, investigations and compliance reviews;
• complying with legal and regulatory obligations;
• improving, developing and optimising the Platform and related services;
• conducting analytics, research and business intelligence activities;
• sending administrative communications relating to Accounts, Bookings and services;
• marketing Wavela's services where permitted by law; and
• exercising or defending legal claims.

We may rely on one or more of the following legal bases when Processing Personal Data:

• the performance of a contract with you;
• compliance with a legal obligation;
• our legitimate business interests, which shall not override your rights and freedoms;
• your consent, where consent is required by law; and
• the establishment, exercise or defence of legal claims.

Where Processing is based on consent, you may withdraw your consent at any time, provided that such withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal.

We may share Personal Data with third parties where reasonably necessary for the operation of the Platform or as otherwise permitted by law.

Personal Data may be disclosed to:

• Guests, Partners and other Users where necessary to facilitate a Booking or service;
• property owners, hosts, experience providers and Water-Based Service providers involved in fulfilling a Booking;
• payment processors and financial institutions;
• cloud hosting, technology infrastructure and software service providers;
• analytics, marketing and customer relationship management providers;
• professional advisers including lawyers, auditors, consultants and insurers;
• regulators, law enforcement agencies and governmental authorities;
• courts, tribunals and dispute resolution bodies; and
• any purchaser, investor, successor or acquirer in connection with a merger, acquisition, restructuring, financing or sale of assets.

Where a Booking involves a property or Water-based Service, Wavela may share information reasonably required for the fulfilment, administration, safety and management of the Booking.

Wavela does not sell Personal Data to third parties for their independent marketing purposes.

We may disclose Personal Data where we reasonably believe such disclosure is necessary to:

• comply with applicable law;
• enforce our contractual rights;
• protect the rights, property or safety of Wavela, its Users or third parties;
• investigate fraud, security incidents or unlawful conduct; or
• respond to lawful requests from public authorities.

Depending on the service or functionality being used, Wavela may use third-party technology and service providers to process Personal Data on its behalf, including:

• Paystack and Flutterwave, for payment processing and related payment services;
• TalkJS, for in-platform messaging and communications between Users;
• Cloudinary, for hosting and managing profile photographs and marine/verification documents;
• Google, for authentication/sign-in services and analytics;
• Resend, for delivery of transactional and other emails;
• Mapbox, for maps and location-related functionality; and
• Vercel, for website hosting and related infrastructure services.

Such service providers shall process Personal Data in accordance with their applicable terms and privacy practices and, where applicable, Wavela's instructions and contractual obligations.

Personal Data may be transferred to, stored in or accessed from jurisdictions outside Nigeria where such transfer is necessary for the operation of the Platform or the provision of services.

Where Personal Data is transferred internationally, Wavela shall implement appropriate safeguards required under Applicable Data Protection Laws, including:

• contractual safeguards
• adequacy-based transfer mechanisms
• Regulatory approvals where required; and
• appropriate technical and organisational security measures.

By using the Platform, you acknowledge that certain service providers engaged by Wavela may process Personal Data in multiple jurisdictions.

Wavela uses cookies and analytics technologies to improve the functionality, performance and security of the Platform.

These technologies may be used to authenticate Users, maintain user sessions, remember preferences and settings, analyse Platform usage and performance, improve functionality and User experience; and detect fraud and security threats. Google Tag Manager and other analytics technologies may also be used to manage and deploy permitted analytics technologies on the Platform.

Certain cookies are necessary for the operation of the Platform and cannot be disabled without affecting functionality.

Where required by law, Wavela will obtain your consent before deploying non-essential cookies or similar technologies.

Users may manage cookie preferences through browser settings or through any cookie preference tools made available on the Platform.

Google Tag Manager shall only be activated for non-essential analytics purposes where the User has provided the applicable consent. Users may manage or withdraw their cookie preferences through the Cookie Preferences control made available on the Platform.

Wavela retains Personal Data only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, regulatory, tax, accounting, dispute resolution, fraud prevention, security and legitimate business requirements.

Different categories of Personal Data may be retained for different periods. In particular:

• tax invoices and records required for financial, tax or accounting purposes may be retained indefinitely or for such longer period as required by applicable law;
• booking, earnings and related financial records may be retained following account closure where necessary for financial, tax, accounting, legal or regulatory purposes, and may be retained in anonymised form where appropriate;
• date of birth may be retained while an Account remains active and until the Account is deleted, subject to applicable legal requirements;
• session, security and administrative logs, including IP addresses and browser information, may be retained for as long as reasonably necessary for security, fraud prevention, troubleshooting, audit and compliance purposes; and
• payment credentials or reusable payment authorisation tokens are retained only for the period reasonably necessary for the applicable Booking and related payment processing purposes.

Where a User requests deletion of an Account, Wavela may anonymise Personal Data associated with the Account while retaining booking, earnings, tax invoice and other records where retention is required or reasonably necessary for legal, regulatory, tax, accounting, dispute resolution, fraud prevention, security or legitimate business purposes.

Where Personal Data is no longer required and is not subject to a lawful retention requirement, Wavela shall securely delete, anonymise or otherwise dispose of such data in accordance with applicable law.

Where a Guest makes a Booking and a reusable payment authorisation or card credential is required to facilitate the Booking or a subsequent adjustment, Wavela or its payment processor may retain a tokenised payment credential or reusable authorisation mechanism. Wavela does not retain the Guest's full card number or security code. Such credential shall be used only for authorised payment purposes, including charging an applicable difference where a Guest reschedules a Booking to a higher-priced Booking, and shall be deleted or deactivated when no longer required for the relevant Booking or authorised payment purpose, subject to applicable legal or regulatory retention requirements.

Wavela implements appropriate technical, organisational and administrative measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access, misuse or other unlawful forms of processing.

Such measures may include:

• Encryption technologies
• Access controls and authentication mechanisms
• Network and system security controls
• Monitoring and logging systems
• Secure data storage practices
• Employee confidentiality obligations
• Periodic security assessments and reviews

While Wavela takes reasonable steps to protect Personal Data, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure. Accordingly, Wavela cannot guarantee absolute security of Personal Data.

Users are responsible for maintaining the confidentiality of their Account credentials and for taking reasonable precautions to protect their devices and personal information.

Where Wavela becomes aware of a Personal Data breach, Wavela shall take appropriate steps to investigate, contain and remediate the breach and, where required by law, notify affected individuals and relevant regulatory authorities.

Subject to applicable law, you may have the right to:

• obtain confirmation as to whether Wavela processes your Personal Data;
• request access to Personal Data held about you;
• request correction of inaccurate, incomplete or outdated Personal Data;
• request deletion of Personal Data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to the processing of Personal Data on grounds relating to your particular situation;
• withdraw consent where processing is based on consent;
• request portability of Personal Data where applicable;
• request information regarding the processing of your Personal Data; and
• lodge a complaint with a competent data protection authority.

Requests relating to Personal Data may be submitted to Wavela using the contact details set out in this Privacy Notice.

Wavela reserves the right to refuse or limit requests where permitted by law, including where compliance would adversely affect the rights and freedoms of others, compromise security, or conflict with legal obligations.

Wavela shall endeavour to respond to valid requests within the timeframe prescribed by applicable law.

Where available through the Platform, Users may exercise certain rights directly through their Account, including downloading their Personal Data, correcting or updating their profile information and requesting deletion of their Account. Where a request cannot reasonably be completed through the Platform, you may contact Wavela using the contact details provided in this Privacy Notice.

Wavela may use automated systems, algorithms and analytical tools to support operational, security and business functions, including:

• Fraud detection and prevention
• Transaction monitoring
• Risk assessment
• Content moderation
• Customer support workflows
• Recommendation and personalization services

Such automated processing is intended to improve Platform security, user experience and operational efficiency.

We do not make decisions based solely on automated processing where such decisions would produce legal or similarly significant effects on an individual, except where authorised by law or where appropriate safeguards are implemented.

Users may contact Wavela to request further information regarding automated processing activities where applicable.

The Platform is not intended for use by individuals under the age of eighteen (18) years. Wavela collects a User's date of birth during registration for the purpose of verifying and enforcing the requirement that Users be at least eighteen (18) years of age. Date of birth shall be retained in accordance with Clause 9 of this Privacy Notice.

We do not knowingly collect Personal Data directly from children.

If we become aware that Personal Data has been collected from a child without appropriate authorisation or legal basis, we shall take reasonable steps to delete such information or otherwise comply with applicable legal requirements.

Parents, guardians or legal representatives who believe that a child has provided Personal Data to Wavela may contact us using the details set out in this Privacy Notice.

Wavela may send Users communications relating to its products, services, promotions, events, experiences, partnerships and other offerings where permitted by Applicable Data Protection Laws and subject to any consent or other requirements imposed by applicable law.

Marketing communications may be delivered by email and any other communication channels that may be made available through the Platform from time to time.

Where required by law, Wavela shall obtain your consent before sending direct marketing communications.

You may opt out of receiving marketing communications at any time by:

• following the unsubscribe instructions included in the communication;
• contacting Wavela directly using the contact details provided in this Privacy Notice.

Opting out of marketing communications will not prevent Wavela from sending service-related, transactional, legal, security or administrative communications.

The Platform may contain links to third-party websites, applications, social media platforms or services that are not owned or controlled by Wavela.

This Privacy Notice does not apply to the privacy practices of any third party.

Wavela is not responsible for the content, security, privacy practices or policies of third-party services.

Users are encouraged to review the Privacy Notice and terms applicable to any third-party service before providing Personal Data.

Wavela may amend, update or revise this Privacy Notice from time to time to reflect changes in law, regulatory requirements, technology, business practices or Platform functionality.

Updated versions of this Privacy Notice shall be published on the Platform together with the applicable effective date.

Where required by law, Wavela shall provide additional notice of material changes through appropriate communication channels.

Continued use of the Platform following the effective date of any revised Privacy Notice shall constitute acknowledgement of the updated Privacy Notice.

If you believe that Wavela has processed your Personal Data in a manner that violates Applicable Data Protection Laws, you may contact Wavela in the first instance using the contact details provided in this Privacy Notice.

If you remain dissatisfied with Wavela's response, you may lodge a complaint with the Nigeria Data Protection Commission or any other competent supervisory authority having jurisdiction over the processing of your Personal Data.

Nothing in this Privacy Notice restricts any statutory rights or remedies available to you under Applicable Data Protection Laws.

Wavela shall designate a Data Protection Officer or other appropriate Data Protection Contact Person from time to time. Details of such appointment shall be made available through the Platform or upon request, where applicable.

If you have any questions, concerns, requests or complaints regarding this Privacy Notice or the processing of your Personal Data, please contact us.